as I wrote on some topics, Iīm about to develop an adaptor to use older non-D flashes with digital cameras. Doing so I discovered parts of the digital protocol used to communicate between flash and body. However, some parts still remain strange to me. So I will share my findings and hope some of you can contribute or make suggestions for the interpretation of the bytes.

1) General protocol informations

Note: all signals are TTL-compatible (5V)

The protocol uses a unidirectional clock line (signal F3 in service manuals) which is always driven by the cam. This line selects the command mode and clocks out/in the data bits. The data line (signal F2) is bidirectional. Mode is selected by various high-times of the high-active clock signal:

The protocol consists of 9 (analog) or 11 (digital) bytes. Each read/write sequence is started by a read or write clock cycle. After each byte thereīs a pause of 200us. Bytes are sent LSB first, 8 bits. A complete read transmission looks like this:
- clock high for 90us
- clock low for 300us -> cam will now read on data line
- clock high for 40us, then low for 40us; the data is sampled on the high->low edge
- previous step is repeated 8 times to get 8 bits
- clock is held low for 200us
- next byte is transmitted by setting clock high/low for 40us each
- ...steps 3 to 5 repeated 9(analog) or 11(digital) times to get the data bytes

Write cycle is the same, but it starts with clock high for 170us, the cam then drives data line to put out data.

The cam will send a read sequence first to get information about the flash. The flash indicator only lights when a compatible flash is detected.

The preflash is triggered when the flash receives a "announce flash" (270us high) and then a "read command" (90us high) within 13ms. Main flash is triggered by pulling flash fire (signal F1) low. For exact timing there has to be a "announce flash" command within some ms before the firing (time not critical). Flash is stopped by setting clock high. Minimum flash time is about 30ms on 5400 series flashes - enough for pre-flash (about 140ms before main flash).

3) Data bytes sent by cam1.-3. byte
As Matthias Paul discovered, these bytes contain aperture, ISO/program mode and zoom setting. The values are described on this page (sorry, german only, but the tables contain numbers only ;-)) The encoding is the same used for lens rom data.

4.-7. byte
0xff, 0xae, 0x7d, 0x40 - no changes, unclear

[edit]5. byte - af illuminator
0xae - illuminator off
0xbe - illuminator on
6. byte HSS
0x7d - no HSS
0xfd - hss
This byte is used by cam to tell the flash if the pending flash should be normal or HSS.
[/edit]

Well, thatīs all I decoded so far. If youīre intrested in building the adaptor, see www.voitzsch.net/flashconv.html for further details. Youīll find a schematic based on ATtiny13 and the actual source code to program it. Adaptor works best with 7D in combination with either 5400HS or XI flash. Thereīs basic support for 5D, alpha and Dimage (i.e., pre- and mainflash is fired, but exposure may vary and not always accurate).

Hope we can discover the complete protocol to build adaptors for complete support for all cameras.

I appreciate the wonderful work you did in this so far. ;) I hope to acquire an adapter kit from you some day.
But at the moment, how can we help you getting more data? Is there an easy way, for example through EXIF-readings, or do we have to take our flashes apart?

I have some of the Minolta system flashes (3/5600, 5200i and a 3500xi), a wireless flash controller (which doesnot work on the newer Dynax (d) bodies), and a few older bodies (700si, 8000i), next to my 5d.
As I drew the right conclusion, your kit should already work with the 3500xi? For the 3/5600 the adaptor is not needed, and for the 5200i something should be done concerning TTL-signalling, right?

as for the 3500xi: donīt know. When working with various flashes (5400HS/XI, 5200i so far) I learned that Minolta always changed a little bit to make work little more difficult. For instance, 7D sends flash time info with 5400 series without any modification; with 5D/Dimage/Alpha you have to change some bits in the flash output to make it work. Never had a 3500xi to test out.

To log the data youīll have to connect the four contacts of the hot shoe to either the parallel port (a) or a special data logger (b). As the flash has to be mounted too the best way is indeed to open up the flash and solder wires to the hot shoe contacts.

a) Parallel connection
First I simply connected the three signals (and GND) to the parallel port of my computer and took "the fabulous logic analyzer" tfla-01 to log the data. Unfortunately tfla-01 isnīt able to convert lows and highs to data bytes, so it means counting then... Now I only use this connection to get an idea of the timing (read/write distinction, preflash, announce signals).

b) data logger
So I needed to have a proper logger. I took an ATmega8 and programmed it so it can be connected to the flash direclty. On the other side you connect a PC via RS232 (38400 bauds). All data between cam and flash will be sent to a console terminal. The logger will capture 22 bytes (11 flash->cam, 11 cam->flash), converts them to hex and prints them out comma-separated. Identical packets are ignored.

The schematics is just a ATmega8 connected to a MAX232, with direct connection to the flash/cam.

Best help would be a combination of logs and ideas on how to interpret the data. Some things are obvious (when turning from P->A and back a byte toggles - not difficult to guess...), some not. Some things are cam or flash specific...

You did great work, sebi. I love this kind of stuff. I wish I had the time to assist.

But have you considered what Sony thinks about this? You're publishing a (probably proprietary) protocol they own, and if they're not happy about that, which I think is the case, they could issue a "cease and desist" order.

Reverse engineering is completely legal (Sigma does it to their great advantage), but publishing the results is probably pushing it...

considered this but donīt think itīs too risky to publish the informations. First, I have no contract with Sony or (Konica-)Minolta telling me I must not discover their protocols (this is a big difference from software, most software producers have such prohibitions in their EULAs). Second, I did not use any software or tools from these firms nor am I disassembling flash or camera firmware. Iīm only sharing my knowledge and no confidential papers Sony gave to me. So I think itīs completely legal, both discovering and publishing the informations.

Furthermore, there are other sites dealing with similiar topics (see lens rom thread herein, Michael Hohners site about wireless protocol and flash timings - which btw. helped a lot, thanks to Michael!) and to my knowledge nobody ever had trouble with at least Minolta so far. Pete Ganzel sold complete service manuals...

the software works with 5D and 7D, flashes are 5400HS, 5400XI, 5200i (without wireless, found no suitable receiver so far), 3500xi. Best support is for 7D - as thatīs the cam I have. Alpha may come soon.

The next step will be to use the HSS-mode preflash for HS models, I expect one version to work with all cams then. Maybe HSS support is added too, donīt know.

For now there are about 30 modified flashes "in the wild" (mostly 5400, some 5200i and one 3500xi), all operating correctly. Some minor exposure glitches with 5D, but all within the +/- 2EV correction.

You cannot post new topics in this forumYou cannot reply to topics in this forumYou cannot delete your posts in this forumYou cannot edit your posts in this forumYou cannot create polls in this forumYou cannot vote in polls in this forum